Protobufjs
CVE-2018-3738
MEDIUM
Severity by source
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files.
AnalysisAI
protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Technical ContextAI
This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. protobufjs is vulnerable to ReDoS when parsing crafted invalid .proto files. Affected products include: Protobufjs Project Protobufjs.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Set resource limits, implement rate limiting, validate input sizes.
More in Protobufjs
View all"protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.5 allows Prototype Pollution, a different vulnerability than
Code injection vulnerability in protobufjs (JavaScript protobuf library) allows authenticated attackers to execute arbit
The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify pro
Denial-of-service via infinite loop in protobuf.js (the pure-JavaScript Protocol Buffers implementation for Node.js/brow
Uncontrolled recursion in protobufjs versions prior to 7.5.8 and 8.2.0 allows remote attackers to exhaust the JavaScript
Prototype pollution in protobuf.js versions 8.2.0 through 8.6.4 allows network-reachable attackers to corrupt JavaScript
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today